An Iranian threat actor was found using a backdoor against an Asian airline in the summer of 2021. The attackers used Slack as the command and control hub for the backdoor they had inserted, the first observation of the use of the workplace messaging application in such a way by a state-sponsored actor.